---
title: Validate Plugin Marketplace Archive
url: https://platform.claude.com/docs/en/api/php/beta/organization/plugin_marketplaces/validate_archive
---

# Validate Plugin Marketplace Archive

`$client->beta->organization->pluginMarketplaces->validateArchive(string archive, ?list<AnthropicBeta> betas): PluginMarketplaceValidationReport`

**POST** `/v1/organizations/plugin_marketplaces/validate_archive`

Check whether a plugin marketplace, uploaded as a `.zip` of the marketplace
directory, would synchronize into claude.ai, without connecting or storing it.

To check a public GitHub repository instead, use Validate Plugin Marketplace Repository.

The report says whether `marketplace.json` is well-formed, which plugins a
synchronization would skip and why, and which plugins would synchronize only in
part, with some files left out. An archive that cannot be read as a marketplace is reported, not refused: the response is a report with `valid: false`. Plugin sources outside the marketplace
are fetched anonymously from GitHub, so a private one is reported as not found or as
needing a GitHub sign-in; a source on any other host is not fetched here, and the
report notes that it will be checked when the marketplace actually synchronizes.

Nothing is recorded on the Compliance API activity feed.

For a worked example, see [Validate marketplace content](https://platform.claude.com/docs/en/manage-claude/plugins-api?sdk_languages=php#validate-marketplace-content)
in the Plugins API guide.

**Accepted credentials:** an Admin API key with the `read:plugins` or `write:plugins` scope; `read:org_audit` and `read:compliance_org_data` do not grant it.

Every request must include the beta header `anthropic-beta: ce-plugins-2026-09-01`. A request without it returns `404`, exactly as if the endpoint did not exist. The Plugins API is in beta and is available to Claude Enterprise organizations only. It is not available to Claude Platform (Claude Console) organizations, or to organizations with HIPAA readiness enabled.

## Parameters

- `archive: string`

  A .zip of the marketplace directory (its contents at the root, or wrapped in one folder as a Git host's download produces), sent as a file part with a filename; DEFLATE- or STORE-compressed, at most 32 MB. A part sent without a filename, a second archive part, or any other form field is a 400; a larger archive is a 413.

- `betas?:optional list<AnthropicBeta>` (header parameter)

  This endpoint is in beta: requests must send `ce-plugins-2026-09-01` in this header.

## Returns

- `class PluginMarketplaceValidationReport`

  - `"plugin_marketplace_validation_report" type`

    Always `plugin_marketplace_validation_report`.

  - `?string commitSha`

    The full SHA of the commit that was validated: for a repository, the commit that was read; for an uploaded archive, the commit recorded in the archive's comment (as a Git host's download writes it; not verified), else null.

  - `?string manifestError`

    Set when nothing could be validated: the repository or archive could not be read, or marketplace.json is missing, malformed or over a limit. Null otherwise.

  - `?string manifestErrorCode`

    A stable identifier for `manifest_error`; null when that is.

  - `list<PluginMarketplaceValidationPluginError> pluginErrors`

    One entry per plugin a synchronization would skip entirely, keyed by the plugin's name in marketplace.json.

  - `list<PluginMarketplaceValidationPluginWarnings> pluginWarnings`

    One entry per plugin that would synchronize with some of its contents left out, keyed by the plugin's name in marketplace.json.

  - `?string ref`

    For a repository, the branch that was read by name: the one requested, or else the branch a synchronization of this repository is set to read. Null when no branch is named or set and the repository's default branch was read, for a request by commit SHA, and for an uploaded archive.

  - `int totalPluginCount`

    How many plugins marketplace.json declares; 0 when it could not be read.

  - `bool valid`

    True when marketplace.json is well-formed and no plugin would be skipped; warnings never make it false.

## Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;
use Anthropic\Beta\AnthropicBeta;
use Anthropic\Core\FileParam;

$client = new Client(apiKey: 'my-anthropic-api-key');

$betaPluginMarketplaceValidationReport = $client
  ->beta
  ->organization
  ->pluginMarketplaces
  ->validateArchive(
  archive: FileParam::fromString('Example data', filename: uniqid('file-upload-', true)),
  betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24],
);

var_dump($betaPluginMarketplaceValidationReport);
```

### Response (200)

```json
{
  "commit_sha": "9fceb02d0ae598e95dc970b74767f19372d61af8",
  "manifest_error": "manifest_error",
  "manifest_error_code": "marketplace_sync_manifest_not_found",
  "plugin_errors": [
    {
      "error": "error",
      "error_code": "marketplace_sync_plugin_missing_manifest",
      "name": "name"
    }
  ],
  "plugin_warnings": [
    {
      "name": "name",
      "warnings": [
        {
          "error_code": "marketplace_sync_zipball_symlink_dangling",
          "message": "message"
        }
      ]
    }
  ],
  "ref": "main",
  "total_plugin_count": 0,
  "type": "plugin_marketplace_validation_report",
  "valid": false
}
```